Audit name:
[SCA] LAKE | ERC20 + Vesting | Sep2023
Date:
Sep 29, 2023
Table of Content
Introduction
We express our gratitude to the LAKE team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
The LAKE project encompasses an ERC20 token-based smart contract system, integrated within a Web3 ecosystem, with the objective of decentralizing access to water resources.
| title | content |
|---|---|
| Platform | Ethereum |
| Language | Solidity |
| Tags | ERC20 token, Vesting, MultiSig |
| Timeline | 01/09/2023 - 28/09/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/lakecompany/LAKE_SCs→ |
| Commit | 56eee439777b6dd163989a1d729d47d02bf222aa |
Review Scope
- Repository
- https://github.com/lakecompany/LAKE_SCs→
- Commit
- 56eee439777b6dd163989a1d729d47d02bf222aa
Audit Summary
10/10
100%
9/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for LAKE |
| Audited By | Hacken |
| Website | https://lak3.io/→ |
| Changelog | 08/09/2023 – Initial Review |
| 28/09/2023 – Second Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for LAKE
- Audited By
- Hacken
- Website
- https://lak3.io/→
- Changelog
- 08/09/2023 – Initial Review
- 28/09/2023 – Second Review
System Overview
The LAKE project encompasses an ERC20 token-based smart contract system, integrated within a Web3 ecosystem, with the objective of decentralizing access to water resources with the following contracts:
LakeToken — simple ERC-20 token. Additional minting is allowed. It has the following attributes: Name: LAKE. Symbol: LAK3. Decimals: 18. Total supply: 950m tokens.
LakeVestingAdvisors — a token vesting contract for advisors. It allows participants to deposit a specified ERC20 token and then withdraw specified ERC20 token in phases, adhering to a lock-up period and withdrawal restrictions.
LakeVestingInvestors — The contract facilitates a vesting mechanism for early investors where they deposit tokens and can later withdraw them based on certain conditions.
LakeVestingPrivate — The contract is a token vesting mechanism that allows users to deposit a specified token and, in return, they can claim and withdraw the token as rewards over time. This contract allows users to lock tokens for 3 phases of three hundred sixty days each (3 years). They are also allowed to claim rewards based on the deposited amount.
LakeVestingTeam - The contract facilitates a vesting mechanism for the team where they deposit tokens and can later unlock them based on certain conditions.
TeamMultiSig - A multi-signature wallet used by the project’s team to call some restricted functions. The initial number of owners is five, which is also the maximum number of owners. The minimum number of owners is four.
Privileged roles
Owner: The only one who can call the control and management functions, such as transferring the ownership of the token contract, minting new tokens, or changing the receiving address of newly minted tokens.
MultiSig Owner: All those wallet addresses englobed by the MultiSig wallet and that participate in its consensus mechanism.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Technical description is robust.
Functional requirements are detailed.
Code quality
The total Code quality score is 9 out of 10.
Solidity Style Guide violations (I-2023-0401).
Redundant interface (I-2023-0406).
Test coverage
Code coverage of the project is 100% (branch coverage).
Security score
Upon auditing, the code was found to contain 0 critical, 4 high, 4 medium, and 5 low severity issues. Out of these, 13 issues have been addressed and resolved, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.8. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
Proposals lack a designated time limit or a timestamp indicating their creation. This absence of temporal context presents a considerable security risk, potentially resulting in erroneous decision-making and the execution of transactions based on obsolete or unreliable data.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-156 | Denial of Service | fixed | High | |
| F-2023-156 | Funds Lock | fixed | High | |
| F-2023-156 | Race Condition; Unauthorized Access To Critical Functions | fixed | High | |
| F-2023-1563 | Undocumented Functionality; Redundant Functionality | fixed | High | |
| F-2023-157 | Missing Event for Critical Value Updation | fixed | Medium | |
| F-2023-1569 | Inefficient Gas Modeling | fixed | Medium | |
| F-2023-156 | Usage of Built-in Transfer | fixed | Medium | |
| F-2023-156 | Checks-Effects-Interactions Pattern Violation | fixed | Medium | |
| F-2023-157 | NatSpec Contradiction | fixed | Low | |
| F-2023-157 | Documentation Contradiction | fixed | Low |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/lakecompany/LAKE_SCs→ |
| Commit | 56eee439777b6dd163989a1d729d47d02bf222aa |
| Whitepaper | Provided→ |
| Requirements | Provided |
| Technical Requirements | Provided |
Scope Details
- Repository
- https://github.com/lakecompany/LAKE_SCs→
- Commit
- 56eee439777b6dd163989a1d729d47d02bf222aa
- Whitepaper
- Provided→
- Requirements
- Provided
- Technical Requirements
- Provided